Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function

A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isomintern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.

A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function MediaGetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.

A segmentation violation in the gfisomapplesettagex function (/isomedia/isomwrite.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A NULL pointer dereference in the gfodfac4cfgdsiv1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A segmentation violation in the gfmediagetcolorinfo function (/mediatools/isomtools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.

A NULL pointer dereference in the gfac4presb4backchannelspresent function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.

A heap use-after-free in the dasherprocess function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file.

A heap buffer overflow in the m2tsdmxsendpacket function (filters/dmxm2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.

A vulnerability was determined in GPAC 26.03-DEV. This affects the function vobsubreadidx of the file /src/mediatools/vobsub.c of the component MP4Box. Executing a manipulation of the argument numlangs can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called 532097084729a936bcdf6a27c41003f3bd7dc3ff. It is best practice to apply a patch to resolve this issue. Two different commits were applied to fix this issue.

A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpddelentry of the file src/isomedia/boxcodebase.c of the component MP4Box. Such manipulation of the argument data leads to heap-based buffer overflow. Local access is required to approach this attack. The exploit is publicly available and might be used. The name of the patch is f29f955f2a3b5e8e507caad3e52319f961bf37bf. It is advisable to implement a patch to correct this issue.

A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gfisomnalusamplerewrite of the file src/isomedia/avcext.c of the component MP4Box. This manipulation of the argument naluoutbs causes double free. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Patch name: f29f955f2a3b5e8e507caad3e52319f961bf37bf. To fix this issue, it is recommended to deploy a patch.

A flaw has been found in GPAC 26.02.0. This affects the function nhmldumpsendframe of the file src/filters/writenhml.c of the component Media File Handler. Executing a manipulation can lead to null pointer dereference. The attack requires local access. The exploit has been published and may be used. This patch is called bd1d94e70e3bef364c07c5a1d94eca5c9f56e160. A patch should be applied to remediate this issue. The project explains: "I would consider most of these more as bugs than vulns but anyway they're good to fix".

A security vulnerability has been detected in GPAC 26.03-DEV-rev342-g80071f700-master. The impacted element is the function txtinprobeduration of the file src/filters/loadtext.c of the component TeXML File Handler. Such manipulation of the argument txmltimescale leads to divide by zero. An attack has to be approached locally. The name of the patch is 86a5191f2e750c767253e27ed6cfd6d547afebc2. A patch should be applied to remediate this issue.

A use-after-free in the gfseiloadfromstateinternal function (/filters/seiload.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 TS file.

A use-after-free in the gffilterpidinstswap function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gfisomaddtrackkind() function at isomedia/isomwrite.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

A NULL pointer dereference in the gffilterinparentchain function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

A use-after-free in the gffilterpidgetpacket function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A buffer overflow in the gfmediaimport function (/mediatools/avparsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

A use-after-free in the gffilterpidinstswapdeletetask function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A use-after-free in the gffilterpidreconfiguretaskdiscard function (/filtercore/filterpid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

A weakness has been identified in GPAC up to 26.02.0. This affects an unknown part of the file src/utils/baseencoding.c of the component ISOBMFF Parser. Executing a manipulation can lead to highly compressed data. The attack needs to be launched locally. The exploit has been made available to the public and could be used for attacks. This patch is called 297f2d8d1f493d8b241330533cd47f7da758aeb3. A patch should be applied to remediate this issue. The vendor confirms: "We added a check on inflate output size, if it surpasses 32 times the input size we stop in error. This value could be adjusted later."

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60474 CWE: CWE-122 (Heap-based Buffer Overflow) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfmediaimport() function in GPAC's media import layer (mediatools/mediaimport.c:1297) imports media tracks from input files into the filter processing pipeline. When MP4Box inspects a crafted MPEG-2 TS file, the function stores a property value that was produced by strdup(""), allocating a 1-byte heap buffer containing only the NUL terminator at address 0x502000003110.

The function subsequently reads 1 byte at offset [1] of this buffer (past its only valid index [0]) at address 0x502000003111, triggering a heap-buffer-overflow read and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 38gfmediaimportmediatoolsmediaimportc1297

Asan-log: ==2016054==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x502000003111 at pc 0x7f11ecdaca1e bp 0x7fffd1145a00 sp 0x7fffd11459f8 READ of size 1 at 0x502000003111 thread T0 #0 0x7f11ecdaca1d in gfmediaimport mediatools/mediaimport.c:1297 #1 0x558a953c08e3 in convertfileinfo /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/fileimport.c:131 #2 0x558a953914b7 in mp4boxmain /media/user/8b16fbb8-17fc-4a2a-99f7-d4da627d0251/gpacasan/applications/mp4box/mp4box.c:6520

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/38/38gfmediaimportmediatoolsmediaimportc1297

References: https://github.com/gpac/gpac/issues/3287 https://www.cve.org/CVERecord?id=CVE-2025-60474 https://infosec.exchange/@sigdevel/116780566799952592

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60473 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterinparentchain() function in GPAC's filter session core (filtercore/filterpid.c:2145) walks the filter parent chain to determine whether a given filter is an ancestor of another, and is called during PID initialization from gffilterpidinittask(). When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors, reused PIDs, and malformed PES headers that produce an abnormal PID chain state, the function is reached with a NULL or uninitialized parent filter pointer.

The function dereferences the parent pointer without validating it, attempting a READ at address 0x000000000008 (null+0x8 field offset), resulting in a segmentation fault and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 36gffilterinparentchainfiltercorefilterpidc2145

Asan-log: ==2015443==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000008 (pc 0x7f7ec2e52c65 bp 0x519000016d80 sp 0x7fffe9ee7390 T0) ==2015443==The signal is caused by a READ memory access. #0 0x7f7ec2e52c65 in gffilterinparentchain filtercore/filterpid.c:2145 #1 0x7f7ec2e7a796 in gffilterpidinittask filtercore/filterpid.c:4932 #2 0x7f7ec2ec3465 in gffsthreadproc filtercore/filtersession.c:2420

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/36/36gffilterinparentchainfiltercorefilterpidc2145

References: https://github.com/gpac/gpac/issues/3285 https://www.cve.org/CVERecord?id=CVE-2025-60473 https://infosec.exchange/@sigdevel/116780471059317580

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60466 CWE: CWE-825 (Expired Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidgetpacket() function in GPAC's filter session core (filtercore/filterpid.c:6827) retrieves the next available packet from a filter PID for processing by downstream filters such as the inspect filter. When MP4Box inspects a crafted MPEG-2 TS file with corrupted PMT descriptors and abnormal PCR discontinuities that drive the pipeline through PID deletion and re-enqueue paths, gffilterpiddel() frees the 336-byte PID instance at filtercore/filterpid.c:5933.

The inspect filter subsequently calls gffilterpidgetpacket() on the invalidated PID without checking whether the PID object has been released, performing a READ of 8 bytes at address 0x513000002dc0 (start of the freed allocation) and crashing the process (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 35gffilterpidgetpacketfiltercorefilterpidc6827

Asan-log: ==1994506==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000002dc0 at pc 0x7fdaa268b8b7 bp 0x7fff42a43b80 sp 0x7fff42a43b78 READ of size 8 at 0x513000002dc0 thread T0 #0 0x7fdaa268b8b6 in gffilterpidgetpacket filtercore/filterpid.c:6827 #1 0x7fdaa2906374 in inspectprocess filters/inspect.c:5218 #2 0x7fdaa26ef401 in gffilterprocesstask filtercore/filter.c:3180

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/35/35gffilterpidgetpacketfiltercorefilterpidc6827

References: https://github.com/gpac/gpac/issues/3284 https://www.cve.org/CVERecord?id=CVE-2025-60466 https://infosec.exchange/@sigdevel/116780402249845037

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit (see References) CVE: CVE-2025-60465 CWE: CWE-416 (Use After Free) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidinstswap() function in GPAC's filter session core (filtercore/filterpid.c:633) swaps PID instance references during PID reconfiguration. When MP4Box inspects a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid stream configurations, the function frees the ctx->pidinst structure (a 336-byte allocation) at filtercore/filterpid.c:716 inside gffilterpidconfigure() but does not reset the pointer to NULL afterwards.

A subsequent code path within the same reconfiguration call dereferences the now-dangling ctx->pidinst pointer, performing a READ of 8 bytes at address 0x513000000598 (24 bytes inside the freed region), resulting in a heap-use-after-free and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 34gffilterpidinstswapfiltercorefilterpidc633

Asan-log: ==1992184==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000598 at pc 0x7f2c95a88277 bp 0x7ffd4ffcb9e0 sp 0x7ffd4ffcb9d8 READ of size 8 at 0x513000000598 thread T0 #0 0x7f2c95a88276 in gffilterpidinstswap filtercore/filterpid.c:633 #1 0x7f2c95a88276 in gffilterpidconfigure filtercore/filterpid.c:919 #2 0x7f2c95a89a22 in gffilterpidconnecttask filtercore/filterpid.c:1311

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/34/34gffilterpidinstswapfiltercorefilterpidc633

References: https://github.com/gpac/gpac/issues/3283 https://www.cve.org/CVERecord?id=CVE-2025-60465 https://infosec.exchange/@sigdevel/116778494176930561

—— Best regards, Alexander A. Shvedov @sigdevel

GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of service (local). The component is: filtercore/filterpid.c (L:574-580): function gffilterpidinstswapdeletetask() improperly accesses freed objects during PID instance swap/delete cleanup, leading to heap use-after-free. The attack vector is: Local (AV:L): a local, authenticated user who processes a specially crafted MPEG-2 TS/MP4 file with MP4Box can trigger the bug during filter teardown (PID instance swap/delete), causing a crash. ¶¶ In GPAC s MP4Box, gffilterpidinstswapdeletetask() in filtercore/filterpid.c may dereference objects after they have been freed when cleaning up PID instances after a swap/delete operation. Crafted inputs (e.g., malformed MPEG-2 TS) can trigger a heap use-after-free and crash; exploitation may be possible.

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60464 CWE: CWE-476 (NULL Pointer Dereference) CVSS 3.1: 4.3 MEDIUM (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gfseiloadfromstateinternal() function in GPAC's SEI loader (filters/seiload.c:225) processes Supplemental Enhancement Information payloads embedded in HEVC and VVC bitstreams transported over MPEG-2 TS. When MP4Box inspects a crafted TS file containing HEVC/VVC streams with malformed NAL units and corrupted PMT descriptors, the NALU demuxer naludmxconfigurepid() frees the codec state buffer at filters/reframenalu.c:370 during PID reconfiguration.

The function subsequently reads 1 byte from the freed 529,176-byte codec state region at address 0x7f7518dceb04 (529,156 bytes inside the freed allocation) without validating whether the buffer has been released, resulting in a heap-use-after-free and process crash (Denial of Service).

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 32filtersseiloadc225ingfseiloadfromstateinternal

Asan-log: ==33468==ERROR: AddressSanitizer: heap-use-after-free on address 0x7f7518dceb04 at pc 0x7f751b19dbf5 bp 0x7ffc77f69500 sp 0x7ffc77f694f8 READ of size 1 at 0x7f7518dceb04 thread T0 #0 0x7f751b19dbf4 in gfseiloadfromstateinternal filters/seiload.c:225 #1 0x7f751b19dbf4 in gfseiloadfromstate filters/seiload.c:265 #2 0x7f751b0ffd02 in naludmxfinalizeauflags filters/reframenalu.c:2360

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/32/32filtersseiloadc225ingfseiloadfromstateinternal

References: https://github.com/gpac/gpac/issues/3278 https://www.cve.org/CVERecord?id=CVE-2025-60464 https://infosec.exchange/@sigdevel/116778370895014131

—— Best regards, Alexander A. Shvedov @sigdevel

Product: GPAC (MP4Box) Affected: gpac/gpac prior to fix commit 62714f27c64a3d1eb7e880f9eed2d38673cb43ce CVE: CVE-2025-60471 CWE: CWE-416 (Use After Free) CVSS 3.1: 8.8 HIGH (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Reporter: sigdevel <https://infosec.exchange/@sigdevel>

Description: The gffilterpidreconfiguretaskdiscard() function in GPAC's filter session core (filtercore/filterpid.c:1341) handles cleanup of filter PID reconfiguration tasks during media import. When MP4Box processes a crafted MPEG-2 TS file containing corrupted PMT descriptors and invalid packet streams, the filter session schedules a PID reconfiguration that triggers deallocation of a pidinst structure via gffilterpidinstswapdelete() in filtercore/filterpid.c:540.

The function subsequently accesses the already-freed 336-byte pidinst region at address 0x513000000580 without validating whether the instance has been released, resulting in a heap-use-after-free on a READ of 8 bytes at that address and potential arbitrary code execution.

Crash is reproducible on the current master branch at the time of discovery. No authentication or special privileges required beyond ability to provide a crafted file.

Reproduction: -Build-opts: --static-build --static-bin --static-modules --enable-debug --extra-cflags="-g -O0" ; -Command: ./MP4Box -info 31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341

Asan-log: ==26772==ERROR: AddressSanitizer: heap-use-after-free on address 0x513000000580 at pc 0x7fe607a8b95d bp 0x7fff9793a4b0 sp 0x7fff9793a4a8 READ of size 8 at 0x513000000580 thread T0 #0 0x7fe607a8b95c in gffilterpidreconfiguretaskdiscard filtercore/filterpid.c:1341 #1 0x7fe607ac2f65 in gffsthreadproc filtercore/filtersession.c:2420 #2 0x7fe607ac81c4 in gffsrun filtercore/filtersession.c:2727

PoC: https://github.com/sigdevel/pocs/blob/main/res/gpac/MP4Box/31/31gffilterpidreconfiguretaskdiscardfiltercorefilterpidc1341

References: https://github.com/gpac/gpac/issues/3279 https://www.cve.org/CVERecord?id=CVE-2025-60471 https://infosec.exchange/@sigdevel/116778301425195980

—— Best regards, Alexander A. Shvedov @sigdevel